Thanks! that worked ... View more

Thank! It got both Ldap and local accounts ... View more

Hmm. Not sure. If I were you I would try to upgrade from 2.1.2 to 2.1.3 and see if that helps. The error you are listing is almost always Python related and Splunk 6.4 comes with a lot of changes in the Python world so maybe you need to run the latest app to be 100% is compatible with 6.4. ... View more

same as any other Splunk app, you can either do it from the Manage Apps page or extract the new package into $SPLUNK_HOME/etc/apps ... View more

Thank you! ... View more

Here's an Answer that answers another question about speeding up LDAP searches, but the search should be a good pattern to use. This relies only on a configured SA-ldapsearch App, the configuration of which is in that app's docs. ... View more

As mentioned, documentation is up again. Sorry for any inconvenience. ... View more

Sadly I couldn't get that to work, even when it referenced an app context. ... View more

Hi, Can you please suggest some use cases for Cyberark on Splunk. ... View more

Hi Linu1988, Thanks for the response!Can you share the script for resizing text. ... View more

This question is definitely going to need some expanding upon. I can tell you that you have a lot of options here, unfortunately your biggest limitation is that this doesn't appear to be time series data, or maybe that field is just omitted on accident from your example. Can you make sure I am understanding your data correctly? user - this field is pretty straight forward, it's a user. unit - is this some sort of business unit? like a team they are a part of? work - is this hours worked? If that's the case, you could show a pie chart of users a bar chart with which users worked x amount of time a bar chart of average amount of time worked by team a bubble chart showing users that worked x amount of time and then the bubble could be the size of their team. Of course you also have gauges, marker gauges, etc. ... View more

These are exactly equivalent (two different command syntax forms that do exactly the same thing). ... View more

I don't think you can, based on the documentation and this previous Splunk Answers posting. ... View more

Try this: index=abc | rex max_match=0 "UDP_PORT=(?\d+)|TCP_PORT=(?\d+)" | search (PORT=* OR TCP_PORT=* OR UDP_PORT=* ) | mvexpand UDP_PORT | mvexpand TCP_PORT | eval pn = if(isnotnull(PORT), PORT, ";") | eval pn = pn . ";" . if(isnotnull(TCP_PORT), TCP_PORT, ";") | eval pn = pn . ";" . if(isnotnull(UDP_PORT), UDP_PORT, ";") | table _time pn | makemv delim=";" pn | mvexpand pn ... View more

Try this index="abc" IP=10.22.23.3 | timechat span=1d dc(PORT) as Port dc(TCP_PORT) as TCP dc(UDP_PORT) as UDP | delta Port | delta TCP | delta UDP | addtotals | where Total!=0 ... View more

Is this the issue with query? ... View more

I did finally manage to find the offending bucket(s). After removing them that were manually copied in, startup works now and we're back up and running. Thank you! ... View more

The most common cause of this is when splunkd is ran as root, but wasnt supposed to run as root. Then it will take ownership of lots of files, including indexes and .conf files... finally if you start it as the less privileged user, it will fail because it cant "own" the files. Solving the issue is usually as simple as a recursive chown on the splunk directory, changing the owner to the less privileged user: chown -Rf username. /opt/splunk etc. ... View more